npm Integration

NPM resolves packages using the registry configured in .npmrc. To route NPM traffic through the Lineaje Proxy, configure .npmrc to use the Proxy’s NPM endpoint and authenticate with a Lineaje Personal Access Token (PAT).

Getting Started

1

Create a Lineaje Personal Access Token (PAT)

Follow the below instructions.

Authentication

2

Store the Lineaje PAT in a secure location

For example, add the token as an environmental variable:

export NPM_AUTH_TOKEN="by9...dPQ=="

For CICD pipelines, like GitHub Actions, this token can be stored as a repository-level secret or an organization-level secret. A sample GitHub Action is added below for your reference.

3

Configure .npmrc

Create a .npmrc file in the root of the Node.js project.

registry=https://observe.fortknox.v2.prod.veedna.com/artifactory/api/npm/gos-all-proxy-npm/
//observe.fortknox.v2.prod.veedna.com/artifactory/api/npm/gos-all-proxy-npm/:_authToken=${NPM_AUTH_TOKEN}

You can choose between observe mode or enforce mode. More details are here:

Modes of Operation

Never commit a .npmrc file that contains a real token or password.

4

Install NPM packages

Now NPM is configured to connect with Lineaje GOS Artifactory and download secure NPM packages through the Lineaje Proxy.

npm install

Sample Configurations

GitHub Actions

This guide explains how to configure a GitHub Actions workflow to install NPM dependencies from Lineaje GOS Artifactory and run unit tests.

1. Create the GitHub Secret

Create a repository-level or organization-level secret to store the Lineaje PAT.

1. Open your GitHub repository.

2. Go to Settings.

3. Open Secrets and variables.

4. Select Actions.

5. Click New repository secret.

Create the following secret:

NPM_AUTH_TOKEN

Set the value to the Lineaje PAT.

This token will be used by actions/setup-node to authenticate with the Lineaje GOS Artifactory NPM registry.

2. Add the GitHub Actions Workflow

Create the following workflow file in your repository:

.github/workflows/npm-tests-gos-artifactory.yml

Add the below content:

name: NPM Run Tests with GOS Artifactory

on:
  pull_request:
    branches: [main]
  workflow_dispatch:
    inputs:
      mode:
        description: "FortKnox mode"
        required: false
        default: "observe"
        type: choice
        options:
          - observe
          - enforce

jobs:
  test:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Set FortKnox mode
        run: |
          MODE="${{ github.event.inputs.mode || 'observe' }}"
          echo "FORTKNOX_MODE=$MODE" >> "$GITHUB_ENV"
          echo "Using FortKnox mode: $MODE"
  
      - name: Set up Node.js
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          registry-url: https://${FORTKNOX_MODE}.fortknox.v2.prod.veedna.com/artifactory/api/npm/gos-all-proxy-npm/

      - name: Install dependencies
        run: npm install

      - name: Run tests
        run: node --test test/*.test.js

Jenkins

This guide explains how to configure Jenkins to build a Node.js project using FortKnox Artifactory as the NPM registry.

1. Configure Node.js in Jenkins

1. Go to Manage Jenkins.

2. Open Tools or Global Tool Configuration.

3. Find the NodeJS installations section.

4. Click Add NodeJS.

5. Set the name as:

NodeJS

1. Select the required Node.js version.

2. Save the configuration.

The name must match the Jenkinsfile value:

nodejs 'NodeJS'

2. Add Artifactory Credentials in Jenkins

1. Go to Manage Jenkins.

2. Open Credentials.

3. Select the appropriate credentials scope, usually:

Jenkins → Global credentials

1. Click Add Credentials.

2. Select credential type:

Username with password

1. Enter your SBOM360 email as username and the Lineaje PAT as password.

2. Set the credential ID, for example:

fortknox-artifactory-creds

1. Save the credential.

This credential ID will be used in the Jenkinsfile:

ARTIFACTORY_CREDS = credentials('fortknox-artifactory-creds')

3. Add .npmrc to the Project

Create a .npmrc file in the root of the Node.js project.

registry=https://<fortknox-artifactory-url>/artifactory/api/npm/<npm-repo-name>/
always-auth=true
//<fortknox-artifactory-url>/artifactory/api/npm/<npm-repo-name>/:_authToken=${NPM_AUTH_TOKEN}

Example:

registry=https://observe.fortknox.v2.prod.veedna.com/artifactory/api/npm/gos-all-proxy-npm/
always-auth=true
//observe.fortknox.v2.prod.veedna.com/artifactory/api/npm/gos-all-proxy-npm/:_authToken=${NPM_AUTH_TOKEN}

4. Add the Jenkinsfile

Add the following Jenkinsfile to the root of the repository.

pipeline {
    agent any

    tools {
        // Ensure this NodeJS tool is configured in Jenkins "Global Tool Configuration"
        nodejs 'NodeJS'
    }

    environment {
        // Jenkins credential should be "Username with password"
        // Password should contain the Lineaje PAT / auth token
        ARTIFACTORY_CREDS = credentials('<credentialID from step 1>')
    }

    stages {
        stage('Build') {
            steps {
                script {
                    // Use only the password/PAT as the NPM auth token
                    // This is for .npmrc entries using _authToken
                    withEnv(["NPM_AUTH_TOKEN=${ARTIFACTORY_CREDS_PSW}"]) {
                        sh 'npm cache clean --force'
                        sh 'npm install --verbose'

                        // Optional: verify packages were resolved from Lineaje FortKnox Artifactory
                        // sh 'grep "resolved" package-lock.json || true'

                        sh 'npm start'
                    }
                }
            }
        }
    }
}

Verifying Proxy Routing

The --verbose flag causes npm to log the full tarball URL. Confirm the Proxy URL appears:

# Expected in build log: 
npm http fetch GET 200 
  https://enforce.fortknox.v2.prod.veedna.com/artifactory/api/npm/ 
  gos-all-proxy-npm/lodash/-/lodash-4.17.21.tgz 

To detect policy violations, search build logs for the string. To learn more, see Detecting Policy Violations in Build Logs.